Sharing information

Answer:

Common documents required by customers are the Information Security Policy, Statement of Applicability, and Audit Report. Other documents can be asked depending upon what customers need.

To share such documents (some of them may have sensible information about your organization) you first should evaluate if the risks are worthy (e.g., the audit report has very sensitive information about your ISMS status, but the requester is your biggest customer or a potential customer you want to include in your portfolio). If you consider that the risk of sharing this information is acceptable , them you should provide a Non Disclosure Agreement with these customers to formalize the required conditions for protection of this information